11. Technical Risks and Debt

#	Risk	Impact	Handling
R-1	conan_scripts/ sits outside the coverage gate. catalog.py and generate.py ship in the repo but are not importable and not covered. They carry their own Conan-API dependency.	A regression there is only found at real runtime, against real Conan state.	Treated as an external tool (chapter 2.2). If it grows, bring it under the same test discipline or split it out.
R-2	--show-config can fail. Resolution validates paths, so inspecting a half-set-up checkout can die before printing anything (ADR-0001).	Someone who only wanted to look is blocked by an unrelated validation error.	Deliberate trade — it doubles as a validator. Worth revisiting if it gets in the way in practice.
R-3	Relocation assumes the checkout is reachable inside the container. denver re-invokes itself there; the bind mount is the project’s compose file’s job.	A wrong mount fails deep inside the container, far from the original command.	Out of denver’s control by design. A clearer message than a bare “file not found” would help.
R-4	No sandbox around executed scripts. Hooks, scripts:, skip-if: and custom commands run with the invoking user’s full rights, driven by config.	Anyone who can edit an env’s config or its scripts can run code as that user.	Same trust model as a Makefile or npm scripts. Fine for version-controlled project repos. Would need work before running untrusted env definitions.
R-5	denver-version: is a floor, not a schema version. An env written for an older denver fails with ordinary key errors, not “this schema is too old”.	Confusing failures on old, unmaintained envs.	Low priority while the consumer base is small. Needs attention before wide external adoption.
R-6	Breaking changes land without deprecation. Pre-1.0, every rename updated every bundled env in the same commit.	An external env pinned to an old denver has to migrate by hand.	Stated policy (chapter 2.2), not an accident. Revisit at 1.0.
R-7	A 100 % coverage gate can reward coverage-shaped tests. Every branch needs some test, which can pull toward “hit this line” instead of “check this behavior”.	The number stays green while a real gap — an odd combination of two keys — survives.	Mitigated by suite structure. Worth watching as the provider set grows.
R-8	Providers depend on other tools’ CLI surface. uv, conan, west and docker compose are driven by argument lists.	An upstream flag change breaks a provider, and the test suite cannot see it — the tests fake those tools.	Examples run end to end in CI (examples.yml). That is where such a break shows up.
R-9	Windows is not a target. denver assumes a POSIX shell, flock, and POSIX process semantics.	Windows users need WSL.	Accepted. Linux and macOS are tested in CI.
R-10	Fingerprints trust their inputs. A stage skips itself when its declared inputs are unchanged. Work done outside those inputs is invisible to it.	Manual changes inside a venv or workspace can survive a run that “should” have rebuilt.	--force exists for exactly this. Each provider’s page states what its fingerprint covers.